Facebook Six Digit Code
(2016) : Found that while the main facebook.com site had strict rate-limiting, "beta" and "mbasic" subdomains ( beta.facebook.com ) did not. An attacker could theoretically force a password reset and then brute-force the six-digit code via these unprotected endpoints. Anand Prakash
If you are still unable to retrieve your code, please let me know so I can guide you further. Tell me: facebook six digit code